RANSOM_SAPNUPUAS.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware adds the following folders:

• %User Temp%\{random hex value}.tmp
• %User Temp%\{random hex value}.tmp\Tools

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops the following files:

• %User Temp%\{random hex value}.tmp\{random hex value}.bat → starts nRansom.exe
• %User Temp%\{random hex value}.tmp\nRansom.exe → Detected as Ransom_Agent.R050C0OIO17
• %User Temp%\{random hex value}.tmp\Interop.WMPLib.dll
• %User Temp%\{random hex value}.tmp\AxInterop.WMPLib.dll
• %User Temp%\{random hex value}.tmp\Tools\your-mom-gay.mp3 → plays in the background

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other Details

This Ransomware does the following:

• Executes the following command:
  
  • "%System%\cmd.exe" /c "%User Temp%\{random hex value}.tmp\{random hex value}.bat {malware path}\{malware name}.exe"
• Executes the following command when pressing unlock button:
  
  • cmd.exe /c del %User Startup%\nLocker.exe
• This ransomware does not encrypt files.

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Startup% is the current user's Startup folder, which is usually C:\Documents and Settings\{user}\Start Menu\Programs\Startup on Windows 2000 and XP, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows Vista, 7, and 8.)

NOTES:

This ransomware displays the following lockscreen as ransom note. Unlock code is 12345

It also displays the following window after unlocking the ransom note: